How to restrict administrators from installing software

[ojosh]

Hi All,

I run Windows 2003 Active Directory Service on my network.

I gave a group of users Local ADMIN Privilege to perform certain task but NOT to intall application on thier PCs

How can I restrict these Local Administrators from Installing Application on their PCs.

Thanks.

 

[skialta]

Short of using a 3rd party utility I don't think this can be done. What you may want to consider is how to allow these users to do what they need to as a regular user. It may involve tweaking the registry or NTFS permissions, but is the better way to go.

 

[porkchopexpress]

Local admins can do anything really that’s the idea, even if you use group policy or reg edits to prevent them they will be able to override these settings.
I would look into a department policy that prevents them from installing software, then if they do you can have them on a discipline charge.


You know what Jack Burton always says at a time like this...

 

[megadan2000]

Why don't you leave them as power users? They will have all the admin rights but they don't have the power to change the system.

 

[porkchopexpress]

Power users are a bad idea as well, MS will phase this group out as soon as they get chance.

http://support.microsoft.com/kb/825069

You know what Jack Burton always says at a time like this...